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Abstract 

Damage-tolerance methodology is positioned to replace safe-life methodologies for designing 
rotorcraft structures. The argument for implementing a damage-tolerance method comes from 
the fundamental fact that rotorcraft structures typically fail by fatigue cracking. Therefore, if 
technology permits prediction of fatigue-crack growth in structures, a damage-tolerance method 
should deliver the most accurate prediction of component life. Implementing damage-tolerance 
(DT) into high-cycle-fatigue (HCF) components will require a shift from traditional DT methods 
that rely on detecting an initial flaw with nondestructive inspection (NDI) methods. The rapid 
accumulation of cycles in a HCF component will result in a design based on a traditional DT 
method that is either impractical because of frequent inspections, or because the design will be 
too heavy to operate efficiently. Furthermore, once a HCF component develops a detectable 
propagating crack, the remaining fatigue life is short, sometimes less than one flight hour, which 
does not leave sufficient time for inspection. Therefore, designing a HCF component will 
require basing the life analysis on an initial flaw that is undetectable with current NDI 
technology. 

Introduction 

There are several methods being postulated to safely and economically design and maintain 
the fatigue life of rotorcraft. These methods are known as stress-life, flaw-tolerance, damage- 
tolerance, and fault-tolerance methods. Traditionally, the fatigue behaviour of rotorcraft has been 
designed and managed using stress-life methods. Stress-life methods directly relate service loads 
to a safe operating life that is based on a linear representation of cumulative damage [a, b]. In 
this method, laboratory specimens are cycled under constant-amplitude loading until failure 
occurs. The resulting data is then summarized as a plot of stress versus cycles, which is 
commonly known as an S-N curve. Based on this laboratory data, the anticipated service loads 
are used to predict the time to failure for an actual structure. In particular, each loading cycle in 
the service spectrum is presumed to cause a specific amount of damage, based on the laboratory- 
defined S-N curve, which is linearly summed to determine when the structure fails. Using this 
method, a specific time to failure is determined and then a factor of safety is applied by retiring 
the structure when a specific number of cycles have been reached. 

The flaw-tolerance method attempts to add additional conservatism to the stress-life method 
by using an S-N curve that is based on using flawed laboratory specimens [c]. The flawed 
specimens are presumed to be representative of the usage environment of the actual structure, 
and are used to define the fatigue life of a damaged component. Based on the fatigue life of the 
flawed specimens, inspection intervals can be determined to retire or repair the component, 
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based on detected damage. Therefore, the part can be designed with a less conservative S-N 
curve because field inspections will be performed, in contrast to the ttaditional stress-life method 
which has no inspection requirement. 

The damage-tolerance method is a fracture-mechanics-based design philosophy that is 
founded on the ability of a structure with a crack to maintain integrity. This method for design 
and fatigue-life management has been promoted extensively by the United States Air Force [d]. 
The assumed crack size inherent in the structure is defined by the detection capability of non- 
destructive inspection (NDI) methods. The Air Force requirements assume an initial crack size 
for fuselage and wing structures to be 1.27 mm, based on component accessibility and NDI 
capabilities. For rotorcraft structural components, a proposed NDI crack size of 0.4 mm is 
currently recommended that is based on manufacturers’ experience [e]. Utilizing these NDI 
initial flaw sizes, a fracture-mechanics approach is used to determine the life of the component, 
and inspection intervals are defined that are based on component accessibility and cost. 

In a high-cycle fatigue environment, such as that experienced by a rotorcraft spindle lug, the 
damage-tolerance method described previously becomes impractical [f] because the number of 
cycles generated per hour of operation can exceed 60,000 [g, h], which results in a predicted 
component failure within hours. This life estimate is overly conservative, since many high-cycle 
fatigue components such as propellers and helicopter rotor hubs are designed with safe-life 
methods and are in service safely for thousands of hours before retirement. Therefore, to 
implement a damage-tolerance design method for these high-cycle fatigue environments, other 
means of determining initial crack sizes and inspection intervals must be investigated. 

The fault-tolerance method is a new method to damage-tolerance design that is intended to 
ease the burden of frequent inspection of high-cycle-fatigue structures. It is based on the concept 
of an equivalent initial flaw size (EIFS) [i], where the damage is presumed to be equivalent to a 
crack-like defect. Similar to the flaw-tolerance method, flawed specimens are used in a damage- 
tolerance analysis to predict a time to failure for different damage conditions and to define 
inspection requirements. This method differs from traditional damage-tolerance methods in that 
the inspections are defined for damage such as corrosion and foreign-object damage, which are 
precursors to cracks, and not specifically for cracks. 

In this paper, stress-life, flaw-tolerance, damage-tolerance, and fault-tolerance methods for 
fatigue-life design and life maintenance of rotorcraft structures that are subjected to a high-cycle 
loading environment are examined and evaluated. In particular, evaluations of the four methods 
are conducted for a fictitious rotorcraft spindle lug in which relative cost, safety and practicality 
of the four methods are compared. In addition, the impact that an altered-usage environment has 
on each of the design and life management methods is examined. To accomplish these goals, 
details of design and life-management methods that are based on the four methods are discussed 
first. Then, the classification of flaws that are used to define fatigue life and inspection intervals 
is presented. Next, the four methods are applied to the rotorcraft spindle lug, the results are 
compared, and the spindle-lug economics are discussed. Finally, a general discussion of the 
overall cost and safety of each method is presented. 

Design and Life-Management Methods 

There currently exist two methods for designing rotorcraft structure: stress-life methods, also 
called the safe-life methods, and damage-tolerance methods. The stress-life methods are based 
on the empirical relationship between stress and failure that is defined by testing of laboratory 
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specimens and by full-scale structural testing. The damage-tolerance methods relate stress and 
failure via fracture mechanics, fatigue-crack growth, or fracture. Within each of these classes of 
methods exist several variances, however, the fundamental method used in each class is the 
same. One important variance of stress-life methods that is considered in the present study is 
known as flaw-tolerance methods. Likewise, one important variance of damage tolerance 
methods that is proposed in the present study for use in design and life management is referred to 
herein as the fault-tolerance method. The fundamental aspects of each of these methods are 
discussed subsequently. 

Stress-life methods 

Palmgren [a] and Miner [b] developed a method that relates the failure of laboratory 
specimens under constant-amplitude loading to the failure of structures. This procedure allows a 
designer to relate the stresses obtained from a design model directly to the number of cycles to 
component failure. For instance, if a component which experiences only one constant- 
amplitude-load value is required to last 1,000,000 cycles. Figure 1 indicates that the vibratory 
stresses may not exceed 90 MPa (see the S-N as-manufactured curve in Figure 1). A more 
complicated structure would require a safe-life analysis where the contribution of individual 
loads must be accounted for in the analysis [j]. 

The management of stress-life-designed components is also straightforward. The design 
analysis yields a time to failure that is based on the S-N curve and component usage, with some 
factor of safety applied. This time to failure is designated as a retirement time at which the 
operator removes the component from service and replaces it with a new part. This component 
replacement is repeated for the life of the structure. Periodic visual inspection of the part, if 
accessible, is usually advised but is not required. 

Flaw-tolerance methods 

To design a component via the flaw-tolerance method, generation of stress-life data (S-N 
curves) for the as-manufactured condition and barely detectable and clearly detectable field 
damage must be generated. Barely and clearly detectable damages are defined by the probability 
of detection for each type of damage by using visual inspection. For this case, data generated for 
an aerospace-grade aluminum has been obtained and is plotted in Figure 1 for the as- 
manufactured condition, light corrosion, foreign-object damage (FOD), heavy corrosion and 
FOD to quantify the barely and clearly detectable damage. Component retirement times are 
determined by using the linear cumulative-damage approach, as defined under stress-life 
methods, based on the barely detectable damage curve, light corrosion and FOD. 

Flaw-tolerance methods are also based on the notion that components can be designed safely 
by using a simple stress-life method. Flowever, instead of using the standard stress-life factors of 
safety, which can be overly conservative, the component is managed by inspection for “flaws,” 
such as corrosion pits or foreign-object damage and subsequently retired from service [c]. This 
method of structural design and management is based solely on the presumption that flawed 
laboratory specimens behave in a similar fashion to a flawed component that is in service. This 
presumption will be further discussed in the subsequent section. 

Life management of the flaw-tolerance-designed component must then be governed by 
periodic inspection. Inspection intervals are based on a linear cumulative-damage analysis of the 
structure by using the clearly detectable flaw-tolerance data (Fig. 1). The failure time is used to 
define an inspection interval. Generally, three inspections must occur prior to the predicted 
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failure time. Furthermore, because the amount of life remaining in a component with a specific 
damage state is known from the S-N testing performed; a “retirement-for-cause” program may 
be implemented while monitoring damage evolution. Retirement for cause describes the process 
of removing a component from service because of clearly detectable damage that is beyond 
repair. For instance, by using the simple example from the stress-life section presented herein 
(90 MPa applied stress), if light corrosion is observed during an inspection at 250,000 cycles, the 
part is not necessarily retired because it has a usable fatigue life of 300,000 cycles remaining 
(Fig. 1). Flowever, the inspection interval of the component would then be decreased to 75,000 
cycles, based on the requirement for three inspections during the remaining safe-life estimate of 
the damaged structure. 




& # & * 


t Flaw teteraoog- \ 
160 t "barafy detectable*’ 


S-N as-manufacturad 


\ 




f? 14 D 
a. 


m 

l 

a > 
>> 
n 


Flaw tolerance 


o?:o o \ w 


mm 


j&iA yj 

’"deary detectable corrosion’* \ ’ \ 

\ \ 


S-N design (3cfi 


Flaw tolerance 


|| SO I: "deary detactabte FOO’” 


\ 


* — m 


JO {■ ♦ Asr«*schined *• Light FDD * Heavy FOO 
[• * Ljght ccrfOSion « Heavy bOrro&tDft 


W 


10* 


nctes 


1# 


Figure 1: Flaw-tolerance Stress-Life data for an aluminum alloy. 


Damage-tolerance methods 

Damage-tolerance methods for design and life management define a crack-growth life as the 
service time required for an initial-crack size, that is readily detectable by nondestructive 
inspection methods, to grow to failure. The fatigue life is computed by using fatigue crack- 
growth-rate data [k] (as shown in Figure 2 this data relates the crack growth rate, da/dN to the 
stress intensity factor, AK, that is a function of geometry, stress and crack size), the component 
geometry, and the usage environment as input into a commercially available computer code such 
as NASGRO [1], NASGRO was used for the subsequent analyses presented herein. The life of 
the component is managed via inspection intervals that are set as a minimum of three 
opportunities to detect the crack during the predicted life [d]. For rotorcraft structural 
components a proposed NDI-based crack size of 0.4 mm is currently recommended, based on a 
manufacturer’s experience [e]. It is presumed this value is based on a risk assessment of the NDI 
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methods used in service and the manufacturing tolerances used in production. Unlike for stress- 
life methods, the component is not necessarily retired at the end of the design life, but is 
managed via increased inspections until the economics of inspection exceed that of component 
replacement. The component is retired or repaired when a crack is found. 
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Figure 2: Fatigue crack-growth rate data for an aerospace grade aluminum alloy. 


Fault-tolerance methods 

Computer scientists have defined fault tolerance as “the ability of a system to respond 
gracefully to an unexpected hardware or software failure” [m]. Herein, this term is used for an 
aerospace application to describe a merging of the flaw-tolerance and damage-tolerance 
methodologies [n] to reduce the burden of inspection for “undetectable” cracks. The focus of the 
fault-tolerance method is to design a structure that is based on manufacturing tolerances and to 
manage the part based on service conditions. However, the inspection for cracks that are 
detectable at manufacture is unrealistic in the field. Typically, a producer can detect damage on 
the order of 0. 1 mm in depth, with a 90% probability, whereas a field inspection may miss a flaw 
as large as 1.0 mm. 

The equivalent initial-flaw-size (EIFS) concept is founded on the assumption that damage 
rapidly evolves into crack-like defects that propagate under fatigue loading [i]. Therefore, all 
stress-life data can be used to predict the size of a crack that must have been present in the 
specimen to cause a failure. In other words, the EIFS is the crack size needed to predict the 
failure of a fatigue specimen. This method can also be applied to flaw-tolerance specimens, 
where pre-existing damage caused the specimen to fail prior to the as-manufactured condition. 
Utilizing the NASGRO [1] computer code, the computation of an EIFS value for each failed S-N 
specimen (Fig. 1) was undertaken and the results are plotted in Figure 3 as a cumulative 
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distribution function. It has been postulated that the stress level has a significant effect on the 
computed EIFS value [o]. For example, the EIFS value is not representative of the physical 
condition of the specimen but of the loading applied to the specimen. If accurate fatigue-crack 
growth-rate data [k], as shown in Figure 2, is used for the analyses there is little dependence on 
stress evident for each condition, with the exception of the heavy FOD, as illustrated in Figure 4. 
The heavy FOD specimens may exhibit residual-stress effects and exhibit an order of magnitude 
or more scatter in both the S-N and EIFS plots. The usage of this data is discussed later in the 
paper. 

The EIFS for the as-manufactured condition is then used to predict a durability life for the 
structure; e.g., assuming an inherent defect in the component will propagate to failure. This 
durability life is used during design to size the component. The EIFS values for the states of 
damage, barely and clearly detectable, are then used to predict a time to failure for each of these 
conditions and to set inspection intervals for this damage accordingly. The inspection for 
damage does not preclude the inspection for cracks, of a detectable size, and when either is 
detected the part is repaired or scrapped. One reason for using this method, in lieu of a classic 
damage-tolerance method, is that high-cycle fatigue components may experience usage 
environments where crack-based inspection is unrealistic. For example, the crack size required 
to achieve an economically viable service life is undetectable by current technologies. 
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Figure 3: Equivalent initial flaw size computed from Stress-Life data (Fig. 1 ). 
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Classification of Flaws 


The flaw- and fault-tolerance methods assume that damage introduced at the specimen level is 
representative of that seen in service. Further, it is assumed that this laboratory damage must 
conservatively encompass all contingencies within reason. Corrosion and foreign-object damage 
are the typical forms of damage for rotorcraft that lead to fatigue cracking and subsequent 
failure. A survey of components that have been removed from service by a rotorcraft 
manufacturer illustrates this trend, as shown in Figure 5. For most cases, the damage found did 
not exceed one millimeter in depth, either corrosion or FOD. Therefore, the classification of 
light and heavy laboratory damage was 0.13 mm and 1.02 mm respectively. While this estimate 
of “flaws” will not encompass every possible scenario, most structures are not designed with 
every contingency in mind. 

The light corrosion found in the field was typically widespread in areas where paint had been 
removed or in an environment where salt spray is evident. In this instance, there is documented 
field data to compare to the laboratory damage, and photographs of both the actual damage and 
that generated in the laboratory are shown in Figure 6. Heavy corrosion was mostly restricted to 
exposed structure subjected to heavy usage, such as a military application. The foreign-object 
damage was mostly due to installation and/or maintenance of nearby components, resulting in 
fine scratches or gouges in the surface. Heavy FOD was seen in cases where impact of the 
structure was noted (a bird strike) or poor maintenance practices were observed. Foreign-object 
damage was introduced into specimens with a CNC machine in an attempt to avoid the residual 
stresses introduced via dynamic impact. However, there is significant variation in inducing 
foreign-object damage in the laboratory [p] as is seen in the scatter of the S-N data (Fig. 1) and 
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corresponding EIFS values (Figs. 3 and 4). The corrosion pits were introduced into specimens 
with electrochemical etching. Contrary to foreign-object damage, this method of damage 
simulation has been shown to model field damage well [q]. 
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Figure 5: Survey of field damage for rotorcraft structure. 



Figure 6: Photographs of field and laboratory light corrosion damage. 


Design and Life Management of a Rotorcraft Spindle Lug 

An example application of the four methods of design and life management is discussed for 
the rotorcraft spindle lug depicted in Figure 7. The lug is required to maintain structural integrity 
for a minimum of 10,000 flight hours, where a single flight hour is described by the loading 
spectrum defined in Figure 8. The critical design dimensions of the lug are as follows: R is the 
outer radius of the lug and defines the attachment areas, t is the thickness of the entire structure 
(both the lug and cylinder ), P is the applied load and r is the inner radius that is fixed to 0. 1 meter 
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to fit the attachment pin. The lug is manufactured from an aircraft-grade aluminum alloy with a 

■5 

density of 2.81 g/cm that is used herein to estimate the structural mass of the lug from each 
design. 



Figure 7: Rotorcraft spindle lug. 



Figure 8: Loading spectrum of spindle lug used to represent one flight hour. 

Stress-life Assessment 

The stress-life method of design and life management is based on the linear cumulative- 
damage relationship described above. The margin of safety applied to the stress-life diagram has 
traditionally been defined by three standard deviations from the mean; that is, the mean curve 
that fits the data is “knocked down” by 3 a. The linear cumulative-damage relationship method 
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can be programmed into a spreadsheet to compute the dimensions of the lug required to meet the 
10,000-hour life requirement. The stresses at the lug root were calculated from the standard 
solution in the literature [r]. The resulting dimensions, structural mass and maximum stress are 
tabulated in Table 1. 

Flaw-tolerance Assessment 

The flaw-tolerance method of design and life management is also based on the stress-life 
linear cumulative-damage relationship described above. However, the margin of safety implied 
in the design is based on the lower bound of the barely detectable damage data, like light 
corrosion and FOD. Unlike traditional stress-life analyses, a finite inspection interval is set 
based on the clearly detectable flaws, e.g., heavy corrosion and FOD. However, for this case the 
foreign-object damage is ignored for comparative purposes, based on the unpredictability of the 
laboratory method. The residual stresses imparted from the FOD, as shown by the improved 
fatigue life of the light FOD (the light FOD data has a higher number of cycles to failure than the 
as-manufactured data for the same stress level, as shown in Figure 1), must be understood before 
a component can be safely designed with this data. Further comment on the effects of using this 
damage is discussed later in the paper. Because the linear cumulative-damage relation is used 
for this method, the analyses can also be performed in a spreadsheet. The resulting dimensions, 
structural mass and maximum stress are also tabulated in Table 1 . 

Damage-tolerance Assessment 

The damage-tolerance method to design and life management is defined by the time it takes 
an initial crack size, defined by nondestructive inspection methods, to cause the structure to fail. 
For the case of rotorcraft structure, the nondestructive inspection (NDI) initial crack size has 
been defined as 0.4 mm. The NASGRO computer code was used to predict the fatigue-crack- 
growth life of a 0.4 mm corner crack to failure. The crack length versus number of hours is 
plotted in Figure 9. The fatigue-crack-growth relationship used within the code incorporates 
load interaction effects of the loading spectrum [s] based on plasticity theory [t]. The material 
data input is a best fit of the R = 0.7 data depicted in Figure 2. The resulting dimensions, 
structural mass and maximum stress are also tabulated in Table 1 . 

Fault-tolerance Assessment 

Fault-tolerance, much like damage-tolerance, determines the design life and inspection 
intervals based on fracture mechanics. However, for the case of fault-tolerance, the design of the 
component is based on the as-manufactured flaw size that is defined by NDI methods available 
to the producer. This size is typically on the order of 0. 1 mm. This value is reasonable because 
the EIFS value computed for the as-manufactured condition was 0.1 mm at a 90% confidence 
level. In designing the spindle lug, the NASGRO computer code was used to predict the fatigue- 
crack-growth life of a 0. 1 mm crack to failure. The NASGRO analysis was also repeated for the 
flawed conditions and is plotted in Figure 10. The light foreign-object damage and corrosion 
generated EIFS values that were comparable to the as-manufactured condition, however, the 
probability of detecting these forms of damage over cracks is significantly higher than a 0. 1 mm 
crack, as shown in Figure 11. However, the probability of detection (POD) for this damage is 
still not to the level that an operator would feel safe relying on this technology. Therefore, 
inspecting for heavy corrosion will provide a safer operating environment and is denoted as HD, 
heavy damage, along with the light damage, LD, in Table 1. The resulting dimensions, structural 
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mass and maximum stress are tabulated in Table 1. The heavy and light FOD damage is once 
again ignored, as with the flaw-tolerance method, for comparative puiposes but will be 
commented on in the discussion section. 
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Figure 10: Fatigue crack growth time to failure for the fault-tolerance method. 
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Table 1: Spindle lug dimensions, mass, stress and inspection interval (if required) 



Safe-life 

Flaw-tolerance 

Da mage-tolera nee 

Fault-tolerance 

Outer Radius (m) 

0.250 

0.250 

0.250 

0.250 

Thickness (m) 

0.021 

0.016 

0.067 

0.044 

Mass (kg) 

100.0 

97.2 

123.2 

112.1 

Max. Stress (MPa) 

34.53 

45.31 

10.35 

16.48 

Inspection time 
(hours) 

Not 

Applicable 

6,000 

3,000 

1.000 HD 

4.000 LD 


Spindle Lug Economics 

The implementation of new technologies into design and life management are driven by 
economics and safety. Therefore, the implementation of the flaw- or fault-tolerance method 
must be weighed versus traditional safe-life and damage-tolerance methods. Furthermore, the 
economics of component inspection and replacement must be weighed by both the manufacturer 
and operator. For the case of a spindle lug, it is assumed that the manufacture and delivery of a 
single lug to an operator is 25,000 dollars plus 1,000 dollars per kilogram (all estimates 
contained herein are in United States Dollars). The cost of an operator to inspect the component 
is a function of the NDI method applied, whether NDI is performed at depot or in the field, and 
the size of the damage being inspected for. A summary of the economics of NDI is plotted in 
Figure 1 1 for the case of the spindle lug. 

Investigating the realities of implementing new design and management technologies requires 
some general assumptions that are based on the actual usage of rotorcraft: 
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1. The component will be operated for three times the original design life. 

2. The actual flights loads are thirty percent higher (vibratory stress) than the design 
spectrum. 

3. The NDI in the field is not being performed in the field at the defined intervals. 
However, the NDI at depot, if prescribed, is regular. 

4. The lug will be made available at depot for a comprehensive inspection every 2,000 
hours, corresponding to the estimated component-life expectancy. The risk of 
incurring damage between depot intervals is plotted in Figure 12. 

5. Life extension methods have been implemented. All light corrosion and FOD will be 
removed at depot and is assumed to behave like the as-machined structure for the 
purpose of this study. 
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Figure 12: Risk of incurring damage between depot intervals. 

Based on these assumptions, the economics of the spindle lug can alter drastically. The 
traditional stress-life method is dependent upon only the new lifetime and stress requirements. 
Increasing the stress levels by thirty percent within the lug will decrease the usable life from 
10,000 hours to 4,060. Therefore, the component will need to be replaced 7 times, as the 
component was originally designed to be replaceable at depot every 10,000 hours, but will now 
be replaced every 4,000 hours at depot. Because there is no inspection mandated in a stress-life 
program, the lack of inspection has no bearing on the affordability of the lug. However, as the 
risk of damage increases, the component will most likely fail 71% of the time from damage prior 
to depot. The scheduled replacement of the lug will increase the cost of operation by 700%. The 
unscheduled replacement could add an additional 350% to the original cost, lawsuits and loss of 
the helicopter not withstanding. This information is recorded in Table 2. 
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The damage-tolerance analysis based on the 0.4 mm crack is affected by the usage increase 
and depot schedule. Timing the inspections with depot could save considerable funds. The 
increased stress levels changed the inspection interval from 3,000 hours to 650 hours, as shown 
in Figure 9. Based on the data presented in Figure 10, the cost of inspection in the field is 
$80,000, whereas the original design could be performed at depot with a cost of $20,000. 
However, the field inspections will not be performed, but inspection will be done at the depot. 
The lack of inspection may save costs, but significantly increases the risk of a field failure. 
Fortunately, the damage-tolerance design life is greater than the inspection interval, allowing one 
inspection prior to the predicted failure time. A crude risk assessment could be based on the 
probability of incurring damage between depot inspections, as depicted in Figure 13. Based on 
the increased risk of failure, the risk assessment would predict that the probability of a field 
failure would be 50%, since only one-third of the inspections are being performed. The true cost 
of operation is summarized in Table 2. 

The flaw-tolerance method is affected by all of the assumptions. The stress-life method yields 
a decrease in overall retirement time and inspection interval, based on the increase in vibratory 
stress. Increasing the stress levels within the lug will decrease the usable life from 10,000 hours 
to 4,400. However, the removal of the light corrosion and FOD every 2,000 hours, if detected, is 
a considerable cost savings as this damage no longer governs retirement, returning the retirement 
time to 10,000 hours. Therefore, the component will need to be replaced twice since the 
component was originally designed to be replaceable at depot every 10,000 hours. The 
inspection intervals defined by heavy corrosion were originally every 6,000 hours; with the 
increased usage the inspection interval is 800 hours. Based on the risk of damage presented in 
Figure 12, the probability of a field failure is 93%, as the inspections are being omitted and the 
part was designed with these in mind. Inspecting the component every 2,000 hours instead of 
6,000 will increase the cost of operation by 300%, which is recorded in Table 2. 

Finally, the fault-tolerance method is impacted by the increase in loads and the lack of 
inspection. The increased stresses changed the inspection interval for light and heavy damage 
from 4,000 / 1,000 hours to 900 / 300 hours, as shown in Figure 13. However, these inspections 
will not be performed in the field. Analogous to the damage-tolerance method, the inspection for 
damage must be coordinated with the depot. For this case, the blending of the light damage from 
the lug leaves a component that is nearly in the as-manufactured condition, effectively resetting 
the overall durability life. Based on the probability of incurring damage between depot services, 
the risk of premature failure is 60%. A summary of the economics of the fault-tolerance method 
is given in Table 2. 
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Figure 13: Life management for the fault-tolerance method. 


Table 2: Spindle Lug economics of ownership (Figures in $1, 000’s). 



Safe-life 

Flaw-tolerance 


Fault-tolerance 

Original design cost 

125 

122 

148 

137 

Original inspection 
cost 

Not 

Applicable 

60 

240 

240 

New design cost 

875 

172 

148 

137 

New inspection cost 

Not 

Applicable 

300 

300 

300 

Probability of 
Failure 

71% 

93% 

50% 

60% 


Discussion 

Changes in usage and operating environment are commonplace in civil and military 
applications. The design of rotorcraft flight-critical components must be robust enough to 
encompass realistic usage spectra that the aircraft is not designed for. For the spindle lug 
example presented herein, the traditional stress-life method to design and life management 
performed poorly. The component would likely fail several times in the field, incurring loss of 
property and life. The flaw-tolerant stress-life method only increased the risk of a catastrophe by 
designing a part based on inspections that must be performed to maintain safety. The design 
initially reduces the cost to the operator through lower weight, but any variability in usage and 
environment will completely degrade safety. The fracture-mechanics-based damage-tolerance 
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method adapted to the altered usage environment well. However, the lack of inspection 
increased the risk of failure by 200%. The fault-tolerance method was also hindered by 
inspection. The risk of failure increased by 250%, more than the comparable damage-tolerant 
component, because the initial design was 10% lighter and designed for more frequent 
inspection. 

The impact of foreign-object damage would show all of these design methods as 
unreasonable. If heavy FOD behaved the same as the laboratory specimens (Fig. 1), all of these 
designs would fail in less than 500 hours. In service, foreign-object damage imparts residual 
stress fields, displaces material and can initiate fatigue cracks instantaneously. It is unrealistic to 
attempt to define FOD in a laboratory setting when the research community cannot agree upon 
the effect of shot peening, which is a controlled process. Therefore, the FOD damage presented 
herein is useful for reference and simple what-if scenarios, however it is useless for design. It is 
important for a company that intends to incorporate flaw- and fault-tolerance methods to keep 
this fact in mind. 

The rotorcraft manufacturer has the challenge of producing a safe and cost effective aircraft. 
Recent research into alternative design methods is a testament to the continued drive to improve 
future products. The traditional stress-life method has proven that the empirical method is 
conservative and safe, since there are few accidents. However, this method does not account for 
any variation in usage, and if the part is damaged in service it can readily fail since no inspection 
plan is required. Based on the spindle-lug example presented herein, a reasonable risk of 
damage is assumed that shows the shortcomings of the stress-life method. The cost of operation 
is increased 7 times, and the risk of failure is increased by 3 Vi times. 

The development of flaw-tolerance methods as a replacement for stress-life methods appears 
reasonable. It is logical that better quantification of usage during the design will lead to a more 
robust structure and inspection will provide a safer operating environment. However, it is 
difficult to truly quantify the usage environment for any single component, and to do such for 
every part on a rotorcraft will be very time consuming and expensive. Further, the flaw- 
tolerance method does not reduce the level of empiricism that is a primary reason for abandoning 
the stress-life method. The flaw-tolerance method to design and life management, as shown by 
the spindle lug example, may not be ideal for rotorcraft design because changes in usage can 
impact safety tremendously. For this case, the probability of the component failing in the field is 
93%. 

Implementation of damage-tolerance methods into the high-cycle fatigue arena has been a 
significant challenge. The aircraft engine manufacturers have been developing methods and 
researching implementation methods for over a decade. The rotorcraft industry will also 
implement damage-tolerance successfully. It will simply take time for the nondestructive 
inspection methods to become practical and cost-effective. However, as shown by the spindle 
lug example, the damage-tolerance method is not overly severe when the economics of operation 
are considered. Furthermore, changes in usage can be accommodated with little additional cost 
and, if inspections are performed, little impact on safety. 

Finally, alternative methods, such as fault-tolerance methods, are meant to improve the 
applicability of damage-tolerance concepts to high-cycle fatigue systems by lessening the 
deficiencies in inspection methods. The basis of the method is damage tolerance, which will 
provide a better estimate for durability life and “retirement for cause” than the stress-life 
methods. However, the method suffers some of the same shortcomings of flaw-tolerance 
methods. It will be very difficult and expensive to quantify the usage environment and 
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subsequently the probability of damage of an aircraft that has yet to fly. However, with advances 
made in probabilistics, risk management and experimental methods, a conservative method can 
be developed. As NDI methods become available to detect cracks of 0. 1 mm or less in the field, 
it would not be unreasonable to transition from fault- to damage-tolerance methods. However, it 
has been shown throughout aviation history that as the NDI methods find smaller flaws, there 
will be a design that requires finer resolution. It is in these new designs that a tool like a fault- 
tolerance method may be fitting. 

Conclusions 

The transition from stress-life management of rotorcraft to that based on damage-tolerance 
will not by easy. There is significant history clearly illustrating stress-life methods as safe and 
reliable. However, rotorcraft manufacturers must still rely upon damage-tolerance methods to 
explain service failures and further maintain the safety of the fleet. It is logical that the adoption 
of damage-tolerance principals into the design will save the company development funds, and 
additional costs when a component unexpectedly fails. Furthermore, as illustrated by the spindle 
lug example presented herein, the cost of operating a damage-tolerance designed part is 
significantly less in the long term, even with changes in the usage environment. Furthermore, 
the continued zeal for stress-life methods, such as flaw-tolerance methods, will cost operators 
and manufacturers both profit and safety. This fact will be replayed every time a manufacturer is 
required to develop damage-tolerance data to manage a field issue, and an operator is hindered 
by unmanageable inspections. Implementation of damage-tolerance design and management 
methods in rotorcraft is possible. Rotorcraft companies prepared to adopt damage-tolerance 
methods will manufacture better, safer products and increase profits for themselves and their 
operators. 
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